Stack-based buffer overflow in IBM DB2 LUW - CVE-2024-49350
Published: June 4, 2025
Vulnerability identifier: #VU110189
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-49350
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform a denial of service attack.
The vulnerability exists due to server may crash under certain conditions with a specially crafted query. A remote unauthenticated user can send a specially crafted query, trigger stack-based buffer overflow and perform a denial of service attack.
Affected software
IBM DB2 LUW
IBM Cloud Pak System
Db2 Big SQL
IBM OpenPages with Watson
Storage Protect Server
IBM Cloud Application Performance Management (APM)
IBM Cloud Pak System
Db2 Big SQL
IBM OpenPages with Watson
Storage Protect Server
IBM Cloud Application Performance Management (APM)
How to mitigate CVE-2024-49350
Install updates from vendor's website.
IBM Cloud Pak System - update to 2.3.6.0
Db2 Big SQL - update to 8.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.27.100
Db2 Big SQL - update to 8.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.27.100
External References
Related Security Bulletins
- Stack-based buffer overflow in IBM Db2
- Multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products
- Multiple vulnerabilities in IBM OpenPages
- Multiple vulnerabilities in IBM Cloud Pak System
- Multiple vulnerabilities in IBM Storage Protect Server
- Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data